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1.  INTRODUCTION 

Contracting,  including  outsourcing  of 
programs  and  services,  is  significantly 
impacted  by  the  Freedom  of 
Information  and  Protection  of  Privacy 
(FOIP)  Act  and  the  records 
management  requirements  set  under 
the  authority  of  the  Records 
Management  Regulation  (RMR). 

2.  POLICY 

For  this  reason,  it  is  the  policy  of  the 
Government  of  Alberta  that  its 
departments,  boards,  agencies  and 
commissions  (collectively  referred  to 
as  “public  bodies”)  take  freedom  of 
information,  protection  of  privacy  and 
records  management  considerations 
into  account  when  contracting. 

3.  PURPOSE  OF  GUIDE 

This  guide  is  provided  to  assist 
Contract  Managers  within  the 
Government  of  Alberta  to  deal  with: 

• freedom  of  information,  protection 
of  privacy  and  records  management 
issues  arising  in  contracting;  and 

• release  of  information  produced 
during  the  contracting  process  in 
response  to  both  FOIP  requests  and 
informal  requests  for  access  to 
information. 

Note  that  this  is  a guide  only.  Legal 
advice  should  be  sought  on  wording 
and  issues  when  establishing  specific 
contracts.  Detailed  advice  on  freedom 
of  information  and  protection  of 
privacy  can  be  obtained  from  your 
public  body’s  FOIP  Coordinator  and 
on  records  management  from  the 


Senior  Records  Officer  (SRO).  A 
more  detailed  guide  on  this  topic  and  a 
brochure  for  contractors  are  also 
available. 

A summary  FOIP  and  Records 
Management  Checklist  for  Contract 
Managers  is  provided  in  Appendix  A. 

4.  CUSTODY  AND  CONTROL  OF 
RECORDS 

In  contracting,  the  legal  requirements 
and  obligations  regarding  freedom  of 
information,  protection  of  privacy  and 
records  management  are  based  on  the 
concepts  of  custody  and  control  of 
records. 

The  RMR  applies  to  all  records  that  are 
in  the  custody  or  under  the  control  of  a 
public  body.  This  includes  records 
transferred  to  or  created,  obtained  and 
maintained  by  a contractor.  Thus  a 
contract  will  have  to  stipulate  a 
number  of  conditions  and  practices 
relating  to  the  management  of  such 
records. 

The  FOIP  Act  applies  to  all  records  in 
the  custody  or  under  the  control  of  a 
public  body,  unless  there  is  a specific 
exception  of  the  records  in  the  FOIP 
Act  or  other  specific  enactment. 
Records  produced  specifically  for  a 
public  body  in  a contract  process  are 
subject  to  the  Act ’s  access  and  privacy 
provisions. 

Custody  means  physical  possession  of 
a record  but  also  involves  guardianship 
of  records.  Where  there  is  a need  to 
guarantee  continuity  of  a public  body’s 
right  to  manage  a record  regardless  of 
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location,  it  will  be  considered  to  have 
custody  of  the  records. 

Control  means  that  a public  body  has 
the  authority  to  manage  the  record 
including  restricting,  regulating  and 
administering  its  use,  disclosure  and 
disposition.  In  its  broadest  sense,  the 
concept  implies  an  ownership  value  in 
the  records. 

Deciding  the  Extent  of  Custody 
or  Controi 

Decisions  about  the  extent  of  custody 
or  control  that  will  be  exercised  by  a 
public  body  over  particular  records 
transferred  to  or  collected,  created,  and 
maintained  by  a contractor  should  be 
based  on  the  nature  of  the  activities 
being  contracted  and  the  management 
objectives  underpinning  the  decision  to 
contract. 

For  example,  very  different  conditions 
of  custody  or  control  may  be  invoked 
between  a simple  contract  for  the 
supply  of  goods  and  services  and  an 
extensive  outsourcing  of  services 
where  a major  objective  is  to  retain 
strict  accountability  or  another  contract 
where  the  public  body  wishes  to 
minimize  its  responsibility  for  an 
operation  or  service.  Decisions  about 
custody  or  control  should  balance 
business  and  accountability  needs  with 
the  overall  costs  to  both  the 
government  and  contractor. 

Some  considerations  which  should  be 
taken  into  account  when  determining 
what  records  should  remain  under  the 
custody  or  control  of  a public  body  are 
as  follows: 


• Have  the  records  only  been 
physically  transferred  to  the 
contractor  but  remain  property  of 
the  Crown  in  right  of  Alberta? 

• Does  the  information  being 
collected  or  created  under  the 
contract  have  to  be  maintained  as  a 
record  in  accordance  with  a 
statute? 

• Is  the  public  body  bound  by  its 
own  legislation  or  regulations  to 
maintain  the  types  of  records 
required  by  the  contract  and  are 
there  other  requirements  to 
maintain  the  records  imposed  by 
legislative  authorities  such  as  the 
Auditor  General? 

• Does  the  public  body  have  the  need 
for  the  creation  and  maintenance  of 
specific  records  which  it  can  access 
either  during  or  beyond  the  life  of 
the  contract? 

• Are  there  records  that  will  be 
needed  for  the  purposes  of 
inspections  or  financial  or  program 
audits? 

• What  records  will  form  the  basis  of 
annual  or  periodic  reports  required 
to  assure  performance  measures  for 
the  contract? 

• Who  has  copyright  of  the  records? 

A contract  should  identify,  as 

specifically  as  possible, 

• any  records  transferred  to  the 
contractor;  and 

• those  types  of  records  required  to  be 
collected  or  created  and  maintained 
by  the  contractor  for  purposes  of 
operational  access  and 
accountability. 
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This  identification  process  is  essential 
to  determine  the  extent  to  which 
particular  records  are  under  the  custody 
or  control  of  a public  body  in  regard  to 
the  application  of  both  the  FOIP  Act 
and  the  RMR. 

In  most  circumstances,  a public  body 
will  exercise  custody  or  control  over 
the  reports,  studies,  products,  service 
summaries  and  financial  statements 
produced  during  a contractor’s  work. 
As  with  current  contract  requirements, 
a public  body  may  ask  that  these  be 
produced  and  maintained  in  a certain 
way  or  to  a certain  standard  and 
retained  for  a specific  period  of  time. 
However,  other  situations  may  be  more 
complicated.  In  such  instances,  it  may 
be  necessary  to  require  access  to  a 
wide  range  of  a contractor’s  files, 
including  operational  or  case  files. 

For  example,  a public  body  contracting 
family  care  services  might  demand 
access  to  licensing,  supervision,  senior 
personnel  and  financial  records  but 
might  not  wish  access  to  general  hiring 
or  facility  maintenance  records. 

Relinquishing  Custody  or 
Control 

It  is  important  to  note  that  the  custody 
or  control  of  records  can  be  reduced  by 
a public  body  through  a contract  but 
cannot  be  completely  extinguished. 
Thus,  the  legal  requirements  of  the 
RMR  and  the  FOIP  Act  may  continue 
to  apply.  It  is  important  that  public 
bodies  include  effective  and  financially 
efficient  ways  to  ensure  that  freedom 
of  information,  protection  of  privacy 
and  records  management  requirements 


are  met  in  contracts  and  in  the 
contracting  process. 

5.  RECORDS  MANAGEMENT 

Records  Management  Practices 

The  contractor  should  be  bound,  by  the 
terms  of  the  contract,  to  deal  with  the 
records  and  information  in  a manner 
consistent  with  the  standards  set  out  in 
the  FOIP  Act.  All  contracts  should 
stipulate: 

• the  types  of  records  the  contractor  is 
expected  to  collect  or  create  and 
maintain  while  performing  the 
contract; 

• the  conditions  or  standards  for  the 
maintenance  of  these  records; 

• the  ownership  of  the  records;  and 

• the  records  retention  and  disposition 
schedule  and  means  for  disposing  of 
the  records. 

In  addition,  where  record  keeping 
forms  a major  part  of  the  contract,  its 
provisions  should  also,  where 
applicable, 

• provide  a definition  of  a record  as  it 
is  understood  in  the  contract.  In 
order  to  avoid  confusion  on  this 
point,  it  would  be  appropriate  to 
adopt  the  legal  definition  from  the 
FOIP  Act  (see  Appendix  B); 

• detail  the  types  of  records 
transferred  to  the  contractor  and 
establish  conditions  for  their 
maintenance  (e.g.,  ownership, 
control,  confidentiality  and  security, 
return  or  disposition  or  destruction); 

• stipulate  any  particular  records 
management  standards  which  may 
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apply  to  records  collected  or  created 
by  the  contractor;  and 

• establish  the  basis  under  which  the 
public  body  will  access  records  in 
the  custody  of  the  contractor  for 
purposes  of  operations  and 
accountability  (e.g.,  on-site 
inspection  or  transfer  of  the  records 
to  the  public  body). 

The  public  body’s  SRO  should  be 
involved  in  establishing  all  terms  and 
conditions  in  a contract  for  the 
management  of  records  and  in  the 
establishment  of  retention  periods  for 
records  and  the  conditions  governing 
their  disposition  or  destruction. 

Some  model  clauses  dealing  with  the 
management  of  records  are  provided  in 
Appendix  B,  section  1 . 

Records  Retention  and 
Disposition 

All  contracts  should  specify  a retention 
period  for  all  records  maintained  by 
the  contractor  which  are  considered 
under  the  custody  or  control  of  a 
public  body. 

The  SRO  of  the  public  body  should  be 
involved  in  the  planning  stage  of  the 
contract  to  ensure  that  records 
scheduling  requirements  are  addressed 
in  the  appropriate  manner  and  actual 
time  periods  should  be  established  for 
the  disposition  of  various  types  of 
records. 

For  uncomplicated  service  contracts,  a 
records  retention  and  disposition 
schedule  should  be  established  which 
permits  the  contractor  to  dispose  of 
records  after  a period  of  time  when  the 


public  body  has  no  more  operational, 
administrative  or  financial  need  for  the 
records. 

Where  a contract  is  more  complicated 
or  involves  a major  record  keeping 
activity,  the  public  body  should 
establish  a retention  and  disposition 
schedule  which  meets  the  special 
requirements  of  the  contract.  This 
should  be  done,  wherever  possible, 
before  the  contract  is  awarded. 

As  well,  because  of  the  sensitivity 
surrounding  the  disposition  of 
government  records,  contracts  should 
stipulate  that  no  disposition  of  records 
(except  for  transitory  records)  can  take 
place  without  notification  of  an 
appropriate  official  within  the  public 
body  and  a written  approval  from  that 
official  that  disposition  can  occur. 
WTiere  information  of  a sensitive  or 
confidential  nature  or  personal 
information  is  involved,  the  SRO  of 
the  public  body  should  provide  advice 
and  generally  supervise  the  disposition 
process.  A public  body  may  also  have 
the  records  transferred  to  its  custody 
for  appropriate  disposition,  including 
destruction  or,  in  some  cases,  transfer 
to  the  Provincial  Archives  of  Alberta. 

6.  FREEDOM  OF  INFORMATION 

All  records  under  the  custody  or 
control  of  a public  body  but 
maintained  on  the  premises  of  a 
contractor  may  be  subject  to  a FOIP 
request.  It  is  important  that  the 
contract  stipulate  clearly  the  mutual 
responsibilities  of  the  public  body  and 
the  contractor  in  dealing  with  such 
requests. 
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A contract  should  also  stipulate  that 
destruction  of  records  in  order  to  evade 
providing  access  to  them  is  an  offence 
under  the  FOIP  Act. 

Model  clauses  are  provided  in 
Appendix  B,  section  2. 

7.  PROTECTION  OF  PRIVACY 

Part  2 of  the  FOIP  Act  obligates  the 
head  of  each  public  body  to  ensure  the 
protection  of  privacy  of  individuals 
through  the  application  of  sections  32 
to  39  of  the  Act. 

Where  the  collection  and/or  handling 
of  personal  information  forms  a part  of 
a contract,  it  is  essential  that  the 
contract  stipulate  that  the  contractor  is 
accepting  the  same  responsibilities  for 
protecting  the  personal  privacy  of 
individuals  as  set  out  in  Part  2 of  the 
Act.  Failure  to  include  this  clause 
means  that  the  public  body  is  not 
passing  on  to  the  contractor  the  privacy 
obligations  established  in  the 
legislation  and  remains  completely 
responsible  for  complaints  from  the 
public  to  the  Information  and  Privacy 
Commissioner  about  inappropriate 
collection,  accuracy,  retention, 
protection,  use  and  disclosure  of 
personal  information  by  the  contractor. 

When  a contract  deals  with  the 
collection,  use  or  disclosure  of 
personal  information.  Part  2 of  the  Act 
requires  that  the  privacy  protection 
provisions  be  applied  to  that 
information.  If  personal  information  is 
involved,  you  must  ensure  that  the 
obligations  for  privacy  protection  are 
carried  out  by  contractors  handling  the 
personal  information. 


A contractor  cannot  be  bound  to  the 
FOIP  Act  merely  by  a statement  to  that 
effect  in  the  contract  and,  therefore,  the 
contract  needs  to  deal  with  the  details 
the  contractor  is  bound  to.  Contracts 
must  stipulate  clearly  the  requirements 
for  collection,  compilation,  accuracy, 
protection,  use,  access,  disclosure, 
correction  and  disposal  of  personal 
information  imposed  by  the  Act  on  the 
public  body  and  assumed  by  the 
contractor.  Where  a contractor  is 
collecting  personal  information  on 
behalf  of  a public  body,  the  contract 
must  stipulate  how  the  requirements  of 
the  Act  will  be  met  by  the  contractor  or 
organization  in  regard  to  controls 
relating  to  the  use,  disclosure,  security 
and  retention  and  disposition  of  the 
personal  information  being  collected. 

An  important  first  step  for  a public 
body  is  to  consider  fully  whether  a 
contractor  needs  to  collect  or  have 
access  to  personal  information. 

Privacy  protection  is  a serious  and 
complicated  business  which  may  add 
costs  to  the  contractor’s  operations  and 
may  reduce  the  contract  value  to  the 
public  body.  There  are  both  economic 
and  privacy  protection  considerations 
which  weigh  against  a contractor  being 
requested  to  collect  and/or  handle 
personal  information  unless  it  is 
absolutely  essential  to  the  business  and 
operational  objectives  being 
accomplished  through  the  contract. 

Since  the  Act  requires  that  collection  of 
personal  information  can  occur  only 
where  specific  authority  for  the 
collection  exists,  it  is  essential,  before 
a contract  is  entered  into,  to  ensure  that 
the  appropriate  authority  exists  to 
collect  and  use  the  personal 
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information  in  the  ways  intended  in  the 
project.  This  will  normally  be  done 
through  consultation  among  the 
Program  Manager,  FOIP  Coordinator 
and  Contract  Manager. 

There  is  a need  to  set  out  specifically 
which  privacy  obligations  are  required 
to  be  met  by  a contractor.  A project 
may  not  involve  all  aspects  of  the 
collection,  use  and  disclosure  of 
personal  information.  The  contract 
should  reflect  only  those  aspects 
relevant  to  the  project.  For  example,  a 
contractor  might  simply  be  given 
access  to  use  certain  personal 
information.  In  such  instances,  the 
controls  over  collection,  accuracy  and 
retention  would  probably  not  apply. 

Appendix  B,  section  2 sets  out  model 
clauses  which  may  be  used  to  deal 
with  privacy  protection  issues  in 
contracts.  The  FOIP  Coordinator  for 
your  public  body  should  be  consulted 
whenever  a contract  deals  with  the 
collection,  compilation,  use  and/or 
disclosure  of  personal  information. 

8.  INDEMNIFICATION  AND 
RESPONSIBILITY  OF 
CONTRACTOR 

The  general  indemnification  clause  in 
contracts  should  be  updated  to  include 
matters  of  freedom  of  information  and 
protection  of  privacy.  Appendix  B, 
section  3 sets  out  model  clauses  which 
may  be  considered  for  this  purpose. 


9.  SPECIAL  REQUIREMENTS  FOR 
REQUEST  FOR  PROPOSAL  AND 
TENDER  DOCUMENTS 

Where  a contracting  process  involves  a 
Request  for  Proposal  (RFP),  tender 
document  or  other  type  of  solicitation 
documentation,  it  is  important  that  a 
number  of  issues  regarding  freedom  of 
information,  protection  of  privacy  and 
records  management  be  considered  for 
inclusion  in  the  governing  document 
prepared  by  the  public  body.  This 
section  deals  with  these  special 
considerations. 

Confidentiality 

It  is  important  to  inform  those  who 
will  submit  documentation  that 
because  of  the  access  provisions  of  the 
FOIP  Act,  complete  confidentiality  for 
any  document  submitted  and  accepted 
can  no  longer  be  ensured. 

At  least  one  complete  copy  of  the 
proposal  or  tender  must  be  kept  on  file 
as  a record  of  the  RFP  or  tendering 
process. 

This  does  not  mean  that  those  who 
submit  documentation  should  be  left 
with  the  impression  that  all  their 
information  will  automatically  be 
disclosed.  Submitters  should  be 
informed  that,  if  a FOIP  request  is 
made  for  records  containing  their 
information,  a number  of  exceptions 
outlined  in  the  Act  may  be  applied, 
including  section  15,  third  party 
business  information,  and  section  16, 
unreasonable  invasion  of  personal 
privacy.  These  exceptions  give  the 
submitter  an  opportunity  to  comment 
on  the  disclosure  of  the  records  before 
access  is  provided.  As  well, 


6 


June  1997 


Contract  Manager’s  Guide  to  FOIP  and  Records  Management 


submitters  should  be  encouraged  to 
identify  appropriate  parts  of  their 
submissions  as  confidential,  since  this 
clearly  establishes  their  expectations 
toward  the  documents,  both  to  the 
public  body  and  to  the  Information  and 
Privacy  Commissioner  in  any  review 
of  a refusal  of  access.  However,  you 
may  not  be  able  to  meet  these 
expectations  in  every  instance. 

For  example,  information  which  the 
contractor  wishes  to  protect  may  not 
qualify  for  any  exception  under  the  Act 
or  may  already  be  in  the  public 
domain.  There  may  also  be  issues  of 
public  interest  or  accountability  to  the 
public  which  must  be  met.  Contractors 
need  to  be  aware  of  the  FOIP 
implications  for  their  documents  as 
early  as  possible  in  the  contracting 
process.  The  RFP  or  tender  documents 
should  contain  a clause  along  the 
following  lines: 

► All  documents  submitted  to  the  (name 
of  public  body)  are  subject  to  the 
protection  and  disclosure  provisions  of 
the  Freedom  of  Information  and 
Protection  of  Privacy  Act.  While  this 
Act  allows  persons  a right  of  access  to 
records  in  the  (public  body’s)  custody 
or  control  it  also  prohibits  the  (name  of 
public  body)  from  disclosing  your 
personal  or  business  information  where 
disclosure  would  be  harmful  to  your 
business  interests  or  would  be  an 
unreasonable  invasion  of  your  personal 
privacy  as  defined  in  sections  15  and 
16  of  the  Act.  Applicants  are 
encouraged  to  identify  what  portions  of 
their  submissions  are  confidential  and 
what  harm  could  reasonably  be 
expected  from  its  disclosure. 

The  above  statement  will  alert 
contractors  to  the  fact  that  their 
information,  once  submitted,  may  be 


disclosed  to  the  public  if  it  is  requested 
and  the  public  body  is  unable  to 
withhold  it  unless  it  can  be  specifically 
excepted  under  the  Act. 

Rating  and  Evaluation  Records 

Specific  reference  should  also  be  made 
in  RFPs  and  similar  documentation  to 
the  matter  of  ratings.  It  should  be 
clearly  stated  that  under  normal 
circumstances  contractor  ratings  will 
not  be  disclosed  but  will  be  released  to 
the  individual  contractor  that  they  are 
about. 

Personal  Information  About 
Contractors 

In  some  cases,  RFPs  may  require  the 
submitter  to  provide  personal 
information  about  those  individuals 
who  will  be  involved  with  a project 
and  to  provide  ratings  and  evaluations 
of  their  abilities  and  work  history.  It  is 
assumed  that  employees  or  associates 
of  a potential  contractor  have  provided 
the  information  for  purposes  of  making 
a proposal  in  order  to  win  a contract. 
The  provision  of  this  information  may 
therefore  be  considered  as  a direct 
collection  of  personal  information  for 
the  purposes  of  the  FOIP  Act.  The  Act 
requires  that  an  individual  be  informed 
about  the  authority  and  purpose  of  the 
collection  of  personal  information.  A 
notice  of  authority  to  collect  personal 
information  along  the  lines  of  the 
following  should  appear  in  the 
introductory  section  of  RFP  or  tender 
documentation. 

► The  purpose  for  collecting  the  personal 
information  required  to  be  provided  in 
this  (RFP  or  tender  document)  is  to 
enable  the  (name  of  public  body)  to 
ensure  the  accuracy  and  reliability  of 
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the  proposal,  and  to  enable  the  (name 
of  public  body)  to  evaluate  your 
response  to  this  (RFP  or  tender 
document)  and  for  other  related 
program  purposes  of  the  (name  of 
public  body).  Authority  for  this 
collection  is  (name  of  statue  and 
section(s)).  You  may  contact  the 
(name  of  appropriate  officer)  at 
(address  and  phone  number)  if  you 
have  any  questions  about  the  collection 
of  information  pursuant  to  this  (RFP  or 
tender  document). 

If  the  information  will  be  used  for 
other  purposes,  these  uses  must  be 
included  in  this  contract  clause. 

Identification  of  Records 

The  types  of  specific  records  which  the 
contractor  will  be  expected  to  create, 
obtain  or  maintain  under  a contract 
should  be  set  out  in  an  RFP  or  tender 
document.  Records  which  will  be 
required  for  operational  and  financial 
accountability  purposes  should  also  be 
specified.  This  is  essential  to 
determining  which  records  created  or 
obtained  by  the  contractor  are  under 
the  control  of  the  public  body,  or  for 
which  it  wishes  to  exercise  custody, 
and  may  be  subject  to  the  access 
provisions  of  the  FOIP  Act. 

Records  Management  Practices 

Where  record  keeping  forms  a major 
part  of  a proposal,  the  RFP  or  tender 
documents  should  include  it  as  an  item 
to  be  assessed  and  evaluated  by  the 
contractor  in  regard  to  both  cost  and 
methodology. 

Except  in  extraordinary  circumstances, 
for  example,  in  cases  of  outsourcing 
where  the  contractor  is  taking  over 
delivery  of  a government  program  or 


service  on  a contract  basis,  it  is  not 
practical  from  the  point  of  view  of 
either  the  public  body  or  the  contractor 
to  fully  duplicate  government  records 
management  practices  for  most 
contracts. 

Any  special  conditions  relating  to  the 
storage  of  records,  which  may  add  to 
the  contractor’s  costs,  should  be 
identified.  For  instance,  contractors 
should  be  advised  that  certain  records 
will  have  to  be  stored  separately  to 
assure  the  proper  application  of 
privacy  protection  requirements, 
particularly  protection  against 
unauthorized  access,  collection,  use, 
disclosure  or  disposal  of  the 
information,  or  permit  the  public  body 
to  maintain  functional  custody  of 
records. 

Freedom  of  Information 
Practices 

Potential  contractors  responding  to  an 
RFP  or  tender  should  be  informed  of 
their  responsibilities  for  participating 
in  a response  to  a FOIP  request.  A 
useful  standard  clause  might  be  as 
follows: 

► The  records  stipulated  in  this  (RFP  or 
tender)  as  being  required  to  be 
maintained  by  the  contractor  may  be 
subject  to  the  protection  and  access 
provisions  of  the  Freedom  of 
Information  and  Protection  of  Privacy 
Act.  Should  (name  of  public  body) 
receive  a request  for  any  of  these 
records  that  are  in  your  custody  it 
would  be  your  responsibility  to  provide 
the  records,  at  your  expense,  to  the 
(name  of  position  and  public  body) 
within  (number)  of  calendar  days  from 
official  notification  by  the  (name  of 
official). 
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Protection  of  Personal 
Information  Practices 

Where  the  collection  and  handling  of 
personal  information  forms  a major 
part  of  an  RFP  or  similar 
documentation,  it  should  either  set  out 
the  privacy  protection  requirements 
which  a potential  contractor  must  live 
up  to  or  request  potential  contractors  to 
provide  a plan  or  approach  through 
which  they  would  propose  to  meet 
these  statutory  obligations. 

Possible  clauses  are  as  follows: 

► The  contractor  will  meet  the  standards 
set  by  the  requirements  of  Part  2 of 
the  Freedom  of  Information  and 
Protection  of  Privacy  Act,  in  so  far  as 
they  are  applicable  to  its  operations 
and  the  personal  information  the 
contractor  has  access  to,  collects  or 
uses,  as  a consequence  of  carrying 
out  its  obligations  under  the  contract. 

► The  Freedom  of  Information  and 
Protection  of  Privacy  Act  requires  the 
protection  of  the  privacy  of  individuals 
whose  information  may  be  involved 
with  meeting  contract  requirements.  In 
accordance  with  the  standards 
established  by  the  requirements  of  Part 
2 of  the  Act,  the  contractor  will  be 
required  to  protect  the  confidentiality 
and  privacy  of  each  individual’s 
personal  information  accessible  to  the 
contractor  or  collected  pursuant  to  the 
(RFP  or  tender  document)  or  this 
contract.  The  contractor  shall  include 
in  its  response  to  this  (RFP  or  tender 
document)  a detailed  plan  describing 
measures  to  meet  each  of  the  following 
requirements,  as  appropriate  for  the 
proposal: 

• manner  of  collection; 

• notification  of  collection  purposes; 

• assurance  of  accuracy; 

• controls  over  uses  and  consistent 
uses; 


• controls  over  disclosure  of  personal 
information; 

• plans  and  controls  over  data 
matching  and  linkage; 

• provision  for  retention  and  disposal 
of  personal  information;  and 

• protection  of  personal  information 
from  unauthorized  access, 
collection,  use,  disclosure  or 
disposal. 

► The  authority  and  purposes  for  any 
collection  of  personal  information  in 
regard  to  this  project  are  as  follows 
(set  out  authority  and  purpose 
statement).  Further  information 
regarding  privacy  protection  measures 
and  this  project  may  be  obtained  from 
(name,  address  and  communication 
numbers  of  appropriate  official). 

10.  OUTSOURCING 

Outsourcing  is  now  a popular  approach 
to  service  delivery  for  public  bodies. 
This  involves  moving  all  or  a 
significant  part  of  a service  previously 
delivered  by  government  over  to 
delivery  by  another  level  of 
government,  non-profit  public 
organizations  or  the  private  sector 
which  are  paid  contracted  sums  for 
providing  the  service  and  assuming  the 
overhead  and  other  costs  associated 
with  it. 

Such  an  approach  has  been  used  for 
the  delivery  of  information  technology 
services  and  is  expanding  into  a broad 
range  of  operational  areas  as  diverse  as 
health,  safety  and  technical  inspections 
to  the  operation  of  programs  or 
facilities.  Such  contracts  require 
basically  the  same  approaches  toward 
proposals  and  contract  or  agreement 
documents  as  described  above  and  the 
same  disclosure  provisions  apply.  The 
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major  difference  is  that  such  contracts 
are  usually  more  detailed  and  complex 
and  require  more  attention,  especially 
with  regard  to  records  management 
and,  where  personal  information  is 
involved,  to  protection  of  privacy. 

Where  a service  was  formerly 
delivered  directly  by  the  government, 
there  is  a strong  public  interest  in 
recognizing  that  the  FOIP  Act  and  the 
RMR  should  apply  to  all  the  records 
transferred,  created,  obtained  and/or 
maintained  as  a result  of  an 
outsourcing  activity.  All  outsourcing 
contracts  dealing  with  the  delivery  of 
government  services  should  contain  a 
section  on: 

a)  records  management,  which  deals 
at  an  appropriate  level  of  detail  with 
the  nature  of  the  records  subject  to 
the  contract  or  agreement,  and  the 
ownership  of  those  records  and 
standards  relating  to  their 
management  and  disposition, 
including  approval  of  records 
retention  and  disposition  schedules 
for  such  records  through  the  Alberta 
Records  Management  Committee. 
Records  management  standards, 
with  the  exception  of  the 
requirement  to  schedule  and  dispose 
of  records,  may  either  reflect  the 
records  management  standards  of 
the  public  body  or  special  standards 
developed  for  the  contract  or 
agreement. 

b)  freedom  of  information,  which 
indicates  that  the  records  are  subject 
to  the  access  provisions  of  the  FOIP 
Act  and  assigns  responsibilities  and 
standards  for  responding  to  FOIP 
requests. 


c)  protection  of  privacy,  which 
establishes  standards  for  the 
protection  of  personal  information 
which  meet  the  requirements  of 
Part  2 of  the  FOIP  Act  and  the 
guidelines  in  the  protection  of 
privacy  section  of  the  FOIP  Policy 
Manual. 

11.  FOIP  REQUESTS 

When  a FOIP  request  is  received  for 
information  on  the  contracting  process, 
you  must  consider  whether  documents 
can  be  released  as  a matter  of  course  or 
if  they  should  be  subject  to  the 
provisions  of  the  FOIP  Act.  If  a 
requested  record  must  be  severed,  the 
request  should  be  handled  as  a formal 
FOIP  request. 

Most  contract  documents  contain  some 
information  that  can  be  disclosed  and 
some  that  must  be  withheld  because 
one  or  more  of  the  following 
exceptions  apply: 

Section  15  - Disclosure  harmful  to  the 
business  interests  of  a 
third  party; 

Section  16  - Disclosure  harmful  to 
personal  privacy; 

Section  18  - Confidential  evaluations 
(awarding  of  government 
contracts); 

Section  23  - Advice  from  officials;  and 

Section  24  - Disclosure  harmful  to 
economic  or  other 
interests  of  the 
government  or  a public 
body. 
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The  types  of  records  involved  in  the 
contracting  process  are  described  in 
Appendix  C with  suggestions  as  to 
how  the  provisions  of  the  FOIP  Act 
might  apply  to  them.  It  must  be  noted, 
however,  that  this  is  only  a guide  to  the 
application  of  the  Act.  Each  situation 
must  be  evaluated  individually 
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APPENDIX  A: 

FOIP  AND  RECORDS  MANAGEMENT  CHECKLIST 
FOR  CONTRACT  MANAGERS 


The  Planning  Stage 

□ How  does  this  contract  or  agreement  fit  into  the  business  objectives  and  activities  of 
the  program  involved?  Is  this  a project  requiring  extensive  operational  controls  over 
the  activities  of  the  contractor  or  less  rigorous  reporting  and  production  of  reports  along 
with  normal  financial  controls? 

□ Given  the  overall  objectives  of  the  contract  or  agreement,  what  records  will  be  created 
by  the  contractor? 

□ Which  of  those  records  does  the  public  body  consider  it  necessary  to  exercise  control 
over  for  operational  and  financial  purposes?  For  how  long? 

□ Is  it  feasible  for  those  records  to  remain  in  the  custody  of  the  contractor  after 
termination  of  the  contract  or  agreement  or  should  they  be  transferred  to  the  public 
body? 

□ Will  the  contractor  be  provided  with  personal  information  or  required  to  collect  or 
compile  such  information? 

□ Is  the  collection  and  use  of  personal  information  necessary  to  meet  the  business 
objectives  of  the  contract  or  agreement  or  are  there  other  ways  of  meeting  these 
objectives,  such  as  providing  non-identifiable  data? 

□ Does  the  public  body  have  the  authority  to  collect  and  use  the  personal  information  it  is 
slating  for  collection? 

The  RFP  or  Tendering  Stage 

□ Has  a clause  been  included  in  the  Request  for  Proposal  (RFP)  or  similar  documentation 
which  states  that  confidentiality  may  be  afforded  to  records  submitted  in  response  to  an 
RFP  or  request  for  tender  only  under  limited  circumstances  as  authorized  under  the 
Freedom  of  Information  and  Protection  of  Privacy  (FOIP)  Act? 

□ Has  reference  been  made  as  to  how  rating  and  evaluation  records  will  be  treated  under 
a FOIP  request? 

□ Has  reference  been  made  to  the  authority  to  collect  personal  information  as  part  of  the 
RFP  or  other  tendering  process? 
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□ Have  the  records  which  need  to  be  created  and  must  be  under  the  public  body's  control 
been  clearly  identified? 

□ Has  there  been  consultation  with  the  Senior  Records  Officer  (SRO)  about  required 
retention  periods  and  any  necessary  structure  for  the  records  and  are  these  requirements 
refiected  in  the  terms  and  conditions  of  the  RFP  or  similar  documentation? 

□ Does  the  RFP  or  similar  documentation  inform  potential  contractors  of  their 
responsibilities  with  respect  to  submitting  records  upon  request? 

□ Where  personal  information  is  involved,  have  potential  contractors  been  informed  that 
the  winning  bidder  will  be  accepting  the  same  responsibilities  for  protecting  the 
personal  privacy  of  individuals  as  required  of  the  public  body? 

□ Where  the  collection  and  handling  of  personal  information  forms  a major  part  of  an 
RFP  or  similar  documentation,  does  the  RFP  or  similar  documentation  either  set  out 
the  privacy  protection  requirements  which  a potential  contractor  must  live  up  to  or 
request  an  approach  from  potential  contractors  as  to  a plan  or  approach  through  which 
they  would  propose  to  meet  these  statutory  obligations? 

□ Have  potential  contractors  been  advised  that  certain  records  will  have  to  be  stored 
separately  from  other  records  to  allow  for  easier  access  by  the  public  body  and  to 
assure  the  proper  application  of  privacy  protection  requirements? 

Awarding  the  Contract 

□ Have  the  applicable  standard  clauses  been  employed  in  the  contract  or  appropriate 
alterations  made  to  them  in  order  to  set  out  a contractor’s  responsibilities  and 
obligations  for  freedom  of  information,  protection  of  privacy  and  records  management 
and  to  establish  the  nature  of  the  public  body's  control,  if  any,  over  the  records  and 
personal  information  involved  with  a project? 
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APPENDIX  B: 

SAMPLE  FOIP  AND  RECORDS  MANAGEMENT  CLAUSES 
FOR  CONTRACTS 

Note:  The  following  clauses  are  provided  as  samples  only.  They  may  only  be  required  in  a 
small  number  of  cases  where  minor  changes  to  the  simple  clauses  for  RTFs  provided  in  the 
body  of  this  guide  prove  insufficient.  Please  seek  legal  advice  on  any  clauses  to  be 
employed  in  particular  contracts.  Where  “Minister”  is  used,  it  may  be  appropriate  to 
replace  it  with  the  name  of  a corporate  public  body  which  is  not  headed  by  a “Minister.” 
The  word  “agreement”  or  a similar  term  can  be  substituted  for  the  word  “contract.” 

Section  1 : Records  Management 

a)  Records  Created  or  Maintained: 

Pursuant  to  this  contract,  the  contractor  will  create  or  obtain  the  following  types  of 
records  (listings  of  types  of  records). 

b)  Conditions  of  Management: 

Pursuant  to  this  contract,  the  contractor  will  maintain  all  referenced  records  in  a usable, 
organized  form  in  accordance  with  any  conditions  or  standards  established  by  the 
(name  of  public  body)  and  appended  to  this  contract. 

c)  Ownership  of  Records: 

The  contractor  acknowledges  that  all  (or  specific)  documents,  surveys,  plans,  reports, 
examinations,  analysis,  master  plates  for  a final  report,  and  any  and  all  other  materials 
whatsoever  related  to  the  services  provided  under  this  contract  are  the  property  of  the 
Minister  and  will  be  given  to  the  Minister  immediately  upon  request  or  at  the  termination 
of  the  contract,  whichever  occurs  first,  (or) 

All  technical  information,  inventions,  methods  and  processes  conceived  or  developed  or 
first  actually  reduced  to  practice  in  carrying  out  this  contract,  are  the  property  of  the 
Minister  and  must  be  fully  and  properly  disclosed  in  writing  to  the  Minister  by  the 
contractor.  The  contractor  may  not,  without  the  written  consent  of  the  Minister,  divulge 
or  use  such  technical  information,  inventions,  methods  or  processes  other  than  in 
carrying  out  the  project,  (or) 

Unless  otherwise  indicated  by  the  Minister  in  a notice,  the  copyright  to  all  material 
prepared  by  the  contractor  under  this  contract  belongs  to  the  Government  of  Alberta. 
Such  material  is  to  be  delivered  to  the  Minister  upon  completion  of  the  project  or  as 
otherwise  specified  in  this  contract. 
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d)  Definition  of  Record: 

In  this  contract,  record  means  a record  of  information  in  any  form,  including  books, 
documents,  maps,  drawings,  photographs,  letters,  vouchers  and  papers  and  any  other 
information  that  is  written,  photographed,  recorded  or  stored  in  any  manner,  but  does 
not  include  software  or  any  mechanism  that  produces  records. 

Note:  If  transitory  records  are  referenced  in  the  contract,  they  should  also  be  defined 
as  to  type  of  record  involved  (e.g.,  draft  or  duplicate  records). 

e)  T ransfer  of  Records : 

Pursuant  to  this  contract,  the  following  types  of  records  (list  types  of  records)  have 
been  provided  to  the  contractor  and  will  be  maintained  in  the  same  organization  and 
under  the  same  conditions  as  they  have  been  maintained  by  the  (name  of  public  body). 

The  contractor  shall  keep  separate  from  all  its  other  records  and  databases  all  personal 
information  transferred  to  it  by  the  (name  of  public  body)  or  collected  or  compiled 
pursuant  to  this  contract. 

f)  Access  by  Public  Body: 

The  contractor  will  provide  the  (types  of  records)  to  the  (name  of  public  body)  in 
accordance  with  the  following  schedule,  (or) 

The  contractor  will  provide  to  the  (name  of  public  body),  at  the  contractor's  expense, 
any  and  all  records  required  to  be  created,  obtained  and  maintained  pursuant  to  this 
contract  within  (number)  calendar  days  of  notification  by  (name  of  position). 

g)  Records  Retention: 

All  records  created,  obtained  and  maintained  pursuant  to  this  contract  become  and 
remain  the  property  of  the  (name  of  public  body)  and  are  to  be  retained  by  the 
contractor  for  a period  of  (months  or  years)  following  the  completion  of  the  contract  and 
then; 

1 ) destroyed  in  accordance  with  government  standards  of  security  used  by  the 
Alberta  Records  Centre  or  returned  to  the  public  body  at  the  contractor's  expense; 
(or) 

2)  provided  to  (name  of  the  public  body)  at  the  conclusion  or  termination  of  the 
contract  at  the  contractor's  expense;  (or) 

3)  the  records  (generic  listing)  provided  by  the  (name  of  public  body)  to  the  contractor 
will  be  returned  to  the  (name  of  public  body)  at  the  conclusion  or  termination  of  the 
contract  at  the  contractor's  expense. 
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A transitory  record  as  defined  under  this  contract  does  not  need  to  be  maintained  and 
managed  by  the  contractor  and  its  destruction  is  authorized  by  the  (name  of  public 
body),  A transitory  record  is  (generic  description  of  types  of  records). 

Notwithstanding  the  above  specifications  or  retention  period  the  contractor  must, 
except  for  transitory  records,  notify  the  (name  of  position  in  public  body)  that  the 
records  are  about  to  be  destroyed  in  accordance  with  the  contract  and  receive  the 
(name  of  public  body's)  prior  written  approval  for  disposition  and  notify  the  (name  of 
public  body)  that  disposition  has  taken  place. 


Section  2:  Freedom  of  Information  and  Protection  of  Privacy 

a)  General  Clauses: 

The  contractor  acknowledges  that; 

1 ) the  Freedom  of  Information  and  Protection  of  Privacy  Act  applies  to  all  information 
and  records  relating  to,  or  obtained,  generated,  collected  or  provided  under  or 
pursuant  to  this  contract; 

2)  section  86  of  the  Act  specifies  that  a person  who  willfully  destroys  any  records 
which  are  subject  to  the  Acf  with  the  intent  to  evade  a request  for  access  to  records 
is  guilty  of  an  offence  and  iS'liable  to  a fine  of  not  more  than  $10,000;  and 

3)  the  Minister  may  commence  legal  action  against  the  contractor,  its  employees  and 
agents  if  there  is  a breach  of  any  of  the  terms  or  conditions  of  the  contract. 

For  the  records  and  information,  possessed  or  obtained  by  the  contractor  in  connection 
with,  under,  or  pursuant  to  this  contract,  the  contractor  agrees  to  conduct  himself  to  a 
standard  consistent  with  the  Acf  when  providing  the  services  or  carrying  out  the  duties 
or  other  obligations  of  the  contractor  under  this  contract. 

The  contractor  is  responsible  for  ensuring  complete  compliance  of  its  employees  and 
agents  with  all  terms  and  conditions  related  to  protection  of  privacy.  In  the  event  that 
the  contractor  becomes  aware  of  a breach  of  any  of  these  terms  or  conditions,  it  shall 
notify  the  (name  of  public  body)  immediately  in  writing. 

The  contractor  agrees  to  notify  each  employee,  officer  and  other  person  who  may  see 
or  obtain  access  to  the  personal  information: 

1)  of  the  legal  provisions,  duties  and  obligations  established  by  Part  2 of  the  Freedom 
of  Information  and  Protection  of  Privacy  Act  \Nh\ch  are  stipulated  in  the  contract. 

2)  that  each  employee,  officer  and  other  person  who  may  see  or  have  access  to  the 
personal  information  is  also  obligated  to  comply  with  the  duties  and  is  subject  to  the 
liabilities  and  obligations  of  the  contractor  under  this  contract. 
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In  this  contract,  personal  information  has  the  same  meaning  as  in  section  1(1  )(n)  of 
the  Freedom  of  Information  and  Protection  of  Privacy  Act  and  means  information  about 
an  identifiable  individual  in  any  form.  The  definition  in  section  1(1  )(n)  of  the  Act  is 
provided  in  attachment  (name  attachment)  to  this  contract. 

Note:  Where  significant  amounts  of  personal  information  are  handled  by  the 
contractor,  or  particular  standards  are  required,  a description  of  the  standards  required 
of  the  contractor  should  be  attached  to  the  contract. 

b)  Collection: 

No  personal  information  may  be  collected  by  the  contractor,  its  employees  or  agents 
unless  the  collection  is  authorized  under  this  contract  (provide  authority  for  and 
purpose  of  the  collection)  or  the  collection  is  expressly  authorized  by  the  Minister  in 
writing  in  advance  of  any  collection  taking  place. 

The  contractor  must  collect  personal  information  directly  from  the  individual  the 
information  is  about  and  must  inform  the  individual  of: 

1 ) the  purpose  for  which  the  information  is  being  collected  as  stated  in  clause of 

this  contract;  and 

2)  the  specific  legal  authority  for  the  collection  as  stated  in  clause of  this 

contract  and  the  title,  business  address  and  business  telephone  number  of  an 
officer  or  employee  of  the  public  body  who  can  answer  the  individual’s  questions 
about  the  collection  as  provided  for  in  clause of  the  contract,  (or) 

3)  The  contractor  is  authorized  to  collect  personal  information  about  individuals  under 
the  authority  of  (stipulate  appropriate  paragraph  of  section  33(1)  of  the  Act). 

c)  Accuracy  and  Completeness: 

The  contractor,  its  employees  and  agents  will  make  every  reasonable  effort  to  ensure 
that  personal  information  that  is  or  is  to  be  used  to  make  a decision  that  directly  affects 
an  individual  is  both  complete  and  accurate. 

d)  Correction: 

The  contractor  acknowledges  that  individuals  or  their  representatives  have  the  right  to 
request  the  Minister  to  correct  personal  information  that  the  contractor,  its  employees 
and  agents  may  have  either  received  from  the  public  body  or  collected  or  compiled 
about  an  individual.  The  contractor  undertakes  to  make  any  corrections  or  annotation 
required  by  the  Minister  within  5 working  days  of  receiving  notice  and  direction  to  do  so 
by  the  (name  of  public  body). 
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e)  Protection  of  Personal  Information: 

The  contractor  must  protect  personal  information  in  its  custody  by  making  reasonable 
security  arrangements  against  such  risks  as  unauthorized  access,  collection,  use, 
disclosure  or  disposal  of  personal  information.  Specific  measures  include  (stipulate 
specific  measures  for  physical,  personnel  and  information  technology  security). 

Examples  of  such  stipulations  might  be: 

1)  Access  to  personal  information  in  a form  that  identifies  or  could  be  used  to  identify 
the  individual(s)  to  whom  it  relates  shall  be  limited  to  (specific  names,  if  possible,  of 
specific  employees  of  the  contractor). 

2)  The  contractor  shall  ensure  that,  prior  to  allowing  any  employee  to  have  or  have 
access  to  any  personal  information,  each  person  named  or  referred  to  above 
swears  an  oath  or  undertaking  of  confidentiality  with  respect  to  the  personal 
information  they  may  become  aware  of  in  the  performance  of  this  (contract  or 
agreement).  Oaths  are  to  be  maintained  on  file  by  the  contractor  for  the  duration  of 
the  contract  and  for  three  years  after  completion  of  the  contract  unless  otherwise 
specified  in  writing  by  the  (name  of  public  body). 

3)  Personal  information  will  only  be  kept  at  the  following  address  (specify).  Security 
will  be  maintained  through  the  following  physical  measures  (e.g.,  locked  cabinets, 
security  zones,  locked  rooms  and  controlled  access  to  the  premises)  and  the 
following  appropriate  information  technology  security  measures  (e.g.,  controlled 
computer  access,  authentication  of  systems  users,  and  communications  security). 

f)  Use: 


The  contractor  shall  not  either  directly  or  indirectly  use  personal  information  except  for 
the  following  purposes  (stipulate  purposes)  necessary  for  the  performance  of  the 
services  provided  by  the  contractor  under  this  contract.  Any  other  uses  for  any 
purpose  other  than  those  set  out  in  this  contract  must  be  expressly  authorized  by  the 
Minister  in  writing  in  advance  of  the  use.  At  the  termination  of  this  contract  the 
contractor,  its  employees  and  agents  shall  not  use  any  personal  information  obtained, 
collected  or  compiled  as  a result  of  this  contract  for  any  purpose. 

g)  Disclosure: 

The  contractor  shall  ensure  that  no  use  or  disclosure  may  be  made  of  the  personal 
information  obtained  by  or  provided  to  the  contractor  for  any  purpose  other  than  what 
is  needed  to  carry  out  this  contract  unless  the  contractor  has  received  the  prior 
express  written  authorization  for  doing  so  from  the  (name  of  public  body). 

h)  Data  Matching  and  Linkage: 

The  contractor  acknowledges  that  data  matching  and  linkage  forms  part  of  the 
services  which  will  be  undertaken  as  part  of  this  contract  and  that  data  matching  and 
linkage  will  be  undertaken  in  compliance  with  the  policy  direction  provided  in  the 
Freedom  Information  and  Protection  of  Privacy  Policy  Manual,  which  is  attached 
to  this  contract  as  (identify  attachment). 
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Data  matching  is  the  comparison  of  personal  data  obtained  from  different  sources, 
including  both  electronic  and  paper-based  formats,  for  the  purpose  of  making 
decisions  about  whom  the  data  pertains  to. 

i)  Management  of  Personal  Information: 


The  contractor  shall  keep  separate  from  all  its  other  records  and  databases  all 
personal  information  transferred  to  it  by  the  (name  of  public  body)  or  collected  or 
compiled  pursuant  to  this  contract. 

All  personal  information  transferred  to  the  contractor  or  collected  or  compiled  by  the 
contractor  pursuant  to  this  contract  becomes  and  remains  under  the  control  of  the 
(name  of  public  body)  and  is  to  be; 

(either) 

1 ) retained  by  the  contractor  for  a period  of  (months/years  - the  minimum  retention 
period  for  personal  information  used  to  make  a decision  directly  affecting  an 
individual  is  one  year)  following  completion  of  the  contract  and  then  (destroyed  in 
accordance  with  government  standards  of  security  used  by  the  Alberta  Records 
Centre  or  returned  to  the  public  body)  at  the  contractor’s  expense; 

(or) 

2)  returned  to  the  (name  of  public  body)  at  the  conclusion  or  termination  of  the 
contract,  at  the  contractor's  expense. 

Personal  information  that  is  a transitory  record  under  the  definition  provided  in  this 
contract  does  not  need  to  be  maintained  and  managed  by  the  contractor  and  its 
destruction  is  authorized  by  the  (name  of  public  body).  Personal  information  that  is  a 
transitory  record  is  (generic  description  of  types  of  records). 


Notwithstanding  the  above  specifications  or  retention  periods,  the  contractor  must, 
except  for  personal  information  that  is  a transitory  record,  notify  the  (name  of  public 
body)  that  the  personal  information  is  about  to  be  destroyed  in  accordance  with  this 
contract,  receive  written  authorization  from  (name  of  position  in  public  body)  prior  to 
actually  destroying  the  personal  information,  and  confirm  with  (name  of  position  in 
public  body)  that  destruction  has  taken  place. 


Appendix  B - 6 


June  1997 


Contract  Manager’s  Guide  to  FOIP  and  Records  Management 


Section  3:  Indemnification  and  Responsibility  of  the  Contractor 

This  hold  harmless  will  survive  this  contract.  The  contractor  agrees  to  being  fully  and  solely 

responsible: 

1)  for  the  actions  of  each  of  its  employees,  agents,  consultants  and  other  persons  with  respect 
to  the  disclosure  and  use  of  information  whether  or  not  the  person  is  or  was  acting  within 
the  scope  of  his/her  employment,  agency,  consultancy  or  other  relationship  with  the 
contractor;  and 

2)  for  any  unauthorized  disclosure  or  use  of  information  which  is  disclosed  to  or  accessible  to 
the  contractor  pursuant  to  or  as  a result  of  carrying  out  this  contract,  regardless  of  the 
cause  (including,  but  not  limited  to,  negligence,  misfeasance,  malfeasance  or  accident  or 
neglect)  of  the  unauthorized  use  or  disclosure  during  the  term  of  this  contract  or  after  the 
expiration  of  earlier  termination  of  this  contract. 
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APPENDIX  C: 

DISCLOSURE  OF  DOCUMENTS  USED  IN  CONTRACTING  * 


Document 

Disclosure  Policy 

Potential  Exceptions 

Comments 

Routinely 

Available 

FOIP 

Request 

Required 

Requisition 

no 

yes 

s23  Advice  from  officials 
s24  Economic  interests  of  government  or 
public  body 

Definition  of  requisition  sometimes 
differs  among  public  bodies 

Tender  documents 

yes 

no 

none 

May  be  available  for  fee 

Invitation  to  Quote  (ITQ), 
tenders  or 

Request  for  Proposal  (RFP) 

yes 

no 

none 

Generally  public  documents 

Bidders  invited  for  ITQ  and  RFP 

yes 

no 

none 

Generally  available  to  public 

Bidders  meeting  minutes 

yes 

no 

none 

List  of  bidders  who  bid 

yes 

no 

List  of  bidders  available 

Bids,  proposals,  tenders 

no 

yes 

si 5 Third  party  business  interests 

si 6 Disclosure  harmful  to  personal  privacy 

Bottom  line  $ amounts  should  be 
released 

Unit  prices 

not  always 

yes,  when 
no  routine 
release 

s24  Economic  interests  of  government  or 
public  body 

si 5 Third  party  business  interests 

Withheld 

Evaluation  committee's  notes, 
memos  etc. 

no 

yes 

si 5 Third  party  business  interests 
si 6 Disclosure  harmful  to  personal  privacy 
si 8 Confidential  evaluations 
s23  Advice  from  officials 

Evaluation  of  each  bid,  proposal, 
tender 

no 

yes 

si 5 Third  party  business  interests 
si 6 Disclosure  harmful  to  personal  privacy 
si 8 Confidential  evaluations 
s23  Advice  from  officials 

Own  evaluation  generally  available 
to  each  bidder 

Summary  of  all  evaluations 

no 

yes 

si 5 Third  party  business  interests 
si 6 Disclosure  harmful  to  personal  privacy 
si 8 Confidential  evaluations 
s23  Advice  from  officials 
s24  Economic  interests  of  government  or 
public  body 

Negotiation  information 

no 

yes 

si 5 Third  party  business  interests 
si 6 Disclosure  harmful  to  personal  privacy 
si 8 Confidential  evaluations 
s23  Advice  from  officials 
s24  Economic  interests  of  government  or 
public  body 

Recommendation  to  award 

no 

yes 

s23  Advice  from  officials 

Signed  contract  or  purchase  order 

no 

yes 

si 5 Third  party  business  interests 
si 6 Disclosure  harmful  to  personal  privacy 
s24  Economic  interests  of  government  or 
public  body 

Generally  disclosed  with  some 
severing 

Bidders'  correspondence  and 
responses 

no 

yes 

si 5 Third  party  business  interests 

si 6 Disclosure  harmful  to  personal  privacy 

Disclosed  with  severing 

* NOTE:  This  chart  is  a guide  showing  the  example  of  a typical  case.  As  for  all  FOIP  requests,  a review  of  the  particular 
records  requested  must  be  made. 
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